Workspace backups: non-blocking hardening from the #130 reviews #147

Non-blocking items left by the QA/Security/UX reviews of the backup add-on (#130). None blocks the beta.

cloud-api (internal/backup):

• Test the checkout-session clear on billing stop (SQL + fake); or restrict SetWorkspaceBackupCheckoutSession to rows in pending_payment or with stripe_removed_at set (stale-tab race).
• Test the attempt advance after a failed migrate AddItem (lifecycle.go ~384).
• ActivateFromCheckout: when the activation write matches no row (n == 0), call refuse() instead of only logging "needs a human".
• Retire an open free re-enable checkout before any rebind that clears the session (avoids a manual refund).
• If writing the advanced stripe_write_attempt fails, surface it (today: log only; Stripe replays the cached refusal up to 24h).
• Toggling cancel_at_period_end restarts the re-enable window (storage cost only).

cloud-ui:

• "Restore is unavailable while backups are off." appears twice in the grace states.
• keptCopy wording when back in good standing: say "the restorable snapshots".
• The restorable/not-restorable split is relative to today; consider a short "based on today" note.

Operator / nan-vmd:

• nan-vm-operator: disable backup policy on unknown/orphan instances after repo deletion #145 (orphan policy after repo deletion), nan-vmd: memory/pids cgroup for the e2fsprogs sandbox #146 (sandbox cgroup).
• Drill: Snapshot shares one StepTimeout with the in-flight wait; Aborted "operation in progress" is not retried.

🤖 Generated with Claude Code